Security Engineer

remoti; Bogotá ciudad; On-site; COP 90,000,000 - 150,000,000; Full time

Job summary

Red Team Operator plans and executes authorized adversary simulations to test prevention, detection, investigation, and response to real-world cyberattacks. This is a mid-career offensive security role (3–5 years) focused on attack execution and the supporting infrastructure behind it.

Responsibilities include conducting recon, initial access, privilege escalation, lateral movement, and deploying red team infrastructure (C2, domains, VPNs).

Qualifications

• 3–5 years in red teaming, pentesting, or adversary emulation; CS/cybersecurity degree.
• Strong knowledge of Windows, Linux, Active Directory, networking, and authentication systems.
• Cloud (AWS/Azure/GCP) and identity/MFA experience preferred.
• Hands-on C2 framework and infrastructure-as-code experience.
• EDR/SIEM experience and telemetry analysis.
• AI-assisted security workflow familiarity a plus.
• Certifications valued (OSCP, CRTO, OSEP, OSWE, GPEN, etc.) but are substitutable with equivalent hands-on experience

Responsibilities

• Execute authorized red team operations emulating real adversary TTPs (MITRE ATT&CK) across the full attack chain: recon, initial access, privilege escalation, lateral movement.
• Deploy and maintain red team infrastructure (C2, redirectors, domains/DNS/TLS, VPNs/proxies, cloud resources) with attention to OPSEC and secure teardown.
• Develop and adapt payloads, implants, and tooling to bypass EDR/AV/network/email/identity controls.
• Build and use AI-enabled offensive security pipelines; assess AI apps/agents for capabilities and impact.
• Analyze telemetry to determine detection gaps; partner with threat hunting, detection engineering, and IR teams (purple teaming).
• Document findings and report to technical and leadership audiences; mentor junior operators.

Skills

Red team operations

Penetration testing

Adversary emulation

Cybersecurity degree

Education

CS / Cybersecurity degree

Tools

C2 frameworks

Infrastructure as code

Job description

Red Team Operator plans and executes authorized adversary simulations to test how well the organization can prevent, detect, investigate, and respond to real-world cyberattacks. This is a mid-career offensive security role (roughly 3–5 years of experience) suited for someone who has run red team operations, penetration tests, or adversary emulation engagements and is comfortable owning both the attack execution and the infrastructure behind it.

The operator acts as a simulated adversary, probing endpoint, identity, network, cloud, and application defense, while also building and maintaining the evasive infrastructure (C2, redirectors, phishing systems) that supports each engagement. The role increasingly incorporates AI-enabled offensive security workflows, using and building pipelines that accelerate recon, tooling, attack-path analysis, and reporting.

Responsibilities

• Execute authorized red team operations emulating real adversary TTPs (MITRE ATT&CK) across the full attack chain: recon, initial access, privilege escalation, lateral
• Deploy and maintain red team infrastructure (C2, redirectors, domains/DNS/TLS, VPNs/proxies, cloud resources) with attention to OPSEC and secure teardown.
• Develop and adapt payloads, implants, and tooling to bypass EDR/AV/network/email/identity controls.
• Build and use AI-enabled offensive security pipelines; assess AI apps/agents for
• Analyze telemetry to determine detection gaps; partner with threat hunting, detection engineering, and IR teams (purple teaming).
• Document findings and report to technical and leadership audiences; mentor junior operators.

Qualifications

• 3–5 years in red teaming, pentesting, or adversary emulation; CS/cybersecurity degree
• Strong knowledge of Windows, Linux, Active Directory, networking, and authentication systems.
• Cloud (AWS/Azure/GCP) and identity/SSO/MFA experience preferred.
• Hands-on C2 framework and infrastructure-as-code experience.
• EDR/SIEM experience and telemetry analysis.
• AI-assisted security workflow familiarity a plus.
• Certifications valued (OSCP, CRTO, OSEP, OSWE, GPEN, etc.) but are substitutable with equivalent hands-on experience